Unscored severity · published Apr 8, 2011
CVE-2011-1071
The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory…
–
CVSS
14.3%
EPSS
No
On KEV
Description
The GNU C Library (aka glibc or libc6) before 2.12.2 and Embedded GLIBC (EGLIBC) allow context-dependent attackers to execute arbitrary code or cause a denial of service (memory consumption) via a long UTF8 string that is used in an fnmatch call, aka a "stack extension attack," a related issue to CVE-2010-2898, CVE-2010-1917, and CVE-2007-4782, as originally reported for use of this library by Google Chrome.
Exploitation
Is it being used?
Exploit prediction (EPSS)14.3% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EG
Eglibc · Gnu
All versions, or not specified · source: NVD
GL
Glibc · Gnu
through 2.12.1; 1.00; 1.01; 1.02; 1.03; 1.04; +34 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2011-1071
CVE.org
https://www.cve.org/CVERecord?id=CVE-2011-1071
Exploit
http://bugs.debian.org/615120
Exploit
http://code.google.com/p/chromium/issues/detail?id=48733
openwall.com
http://openwall.com/lists/oss-security/2011/02/26/3
Exploit
http://openwall.com/lists/oss-security/2011/02/28/11
openwall.com
http://openwall.com/lists/oss-security/2011/02/28/15
Exploit
http://scarybeastsecurity.blogspot.com/2011/02/i-got-accidental-code-execution-via.html
More from Eglibc
–
CVE-2011-2702
Integer signedness error in Glibc before 2.13 and eglibc before 2.13, when using Supplemental Streaming SIMD Extensions 3 (SSSE3) optimization, allows context-dependent attackers…
–
CVE-2013-4788
The PTR_MANGLE implementation in the GNU C Library (aka glibc or libc6) 2.4, 2.17, and earlier, and Embedded GLIBC (EGLIBC) does not initialize the random value for the pointer…